German language improvements (bug #1606)
[asterisk/asterisk.git] / acl.c
1 /*
2  * Asterisk -- A telephony toolkit for Linux.
3  *
4  * Various sorts of access control
5  * 
6  * Copyright (C) 1999, Mark Spencer
7  *
8  * Mark Spencer <markster@linux-support.net>
9  *
10  * This program is free software, distributed under the terms of
11  * the GNU General Public License
12  */
13
14 #include <stdio.h>
15 #include <stdlib.h>
16 #include <pthread.h>
17 #include <string.h>
18 #include <sys/time.h>
19 #include <signal.h>
20 #include <errno.h>
21 #include <unistd.h>
22 #include <asterisk/acl.h>
23 #include <asterisk/logger.h>
24 #include <asterisk/channel.h>
25 #include <asterisk/utils.h>
26 #include <arpa/inet.h>
27 #include <sys/socket.h>
28 #include <netdb.h>
29 #include <net/if.h>
30 #include <netinet/in_systm.h>
31 #include <netinet/ip.h>
32 #include <sys/ioctl.h>
33 #if defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD__)
34 #include <fcntl.h>
35 #include <net/route.h>
36
37 static ast_mutex_t routeseq_lock = AST_MUTEX_INITIALIZER;
38 #endif
39
40 #define AST_SENSE_DENY                  0
41 #define AST_SENSE_ALLOW                 1
42
43 struct ast_ha {
44         /* Host access rule */
45         struct in_addr netaddr;
46         struct in_addr netmask;
47         int sense;
48         struct ast_ha *next;
49 };
50
51 /* Default IP - if not otherwise set, don't breathe garbage */
52 static struct in_addr __ourip = { 0x00000000 };
53
54 struct my_ifreq {
55         char ifrn_name[IFNAMSIZ];       /* Interface name, e.g. "eth0", "ppp0", etc.  */
56         struct sockaddr_in ifru_addr;
57 };
58
59 void ast_free_ha(struct ast_ha *ha)
60 {
61         struct ast_ha *hal;
62         while(ha) {
63                 hal = ha;
64                 ha = ha->next;
65                 free(hal);
66         }
67 }
68
69 struct ast_ha *ast_append_ha(char *sense, char *stuff, struct ast_ha *path)
70 {
71         struct ast_ha *ha = malloc(sizeof(struct ast_ha));
72         char *nm;
73         char tmp[256] = "";
74         struct ast_ha *prev = NULL;
75         struct ast_ha *ret;
76         int x,z;
77         unsigned int y;
78         ret = path;
79         while(path) {
80                 prev = path;
81                 path = path->next;
82         }
83         if (ha) {
84                 strncpy(tmp, stuff, sizeof(tmp) - 1);
85                 nm = strchr(tmp, '/');
86                 if (!nm)
87                         nm = "255.255.255.255";
88                 else {
89                         *nm = '\0';
90                         nm++;
91                 }
92                 if (!strchr(nm, '.')) {
93                         if ((sscanf(nm, "%i", &x) == 1) && (x >= 0) && (x <= 32)) {
94                                 y = 0;
95                                 for (z=0;z<x;z++) {
96                                         y >>= 1;
97                                         y |= 0x80000000;
98                                 }
99                                 ha->netmask.s_addr = htonl(y);
100                         }
101                 } else if (!inet_aton(nm, &ha->netmask)) {
102                         ast_log(LOG_WARNING, "%s not a valid netmask\n", nm);
103                         free(ha);
104                         return path;
105                 }
106                 if (!inet_aton(tmp, &ha->netaddr)) {
107                         ast_log(LOG_WARNING, "%s not a valid IP\n", tmp);
108                         free(ha);
109                         return path;
110                 }
111                 ha->netaddr.s_addr &= ha->netmask.s_addr;
112                 if (!strncasecmp(sense, "p", 1)) {
113                         ha->sense = AST_SENSE_ALLOW;
114                 } else {
115                         ha->sense = AST_SENSE_DENY;
116                 }
117                 ha->next = NULL;
118                 if (prev)
119                         prev->next = ha;
120                 else
121                         ret = ha;
122         }
123         return ret;
124 }
125
126 int ast_apply_ha(struct ast_ha *ha, struct sockaddr_in *sin)
127 {
128         /* Start optimistic */
129         int res = AST_SENSE_ALLOW;
130         while(ha) {
131                 /* For each rule, if this address and the netmask = the net address
132                    apply the current rule */
133                 if ((sin->sin_addr.s_addr & ha->netmask.s_addr) == (ha->netaddr.s_addr))
134                         res = ha->sense;
135                 ha = ha->next;
136         }
137         return res;
138 }
139
140 int ast_get_ip(struct sockaddr_in *sin, char *value)
141 {
142         struct hostent *hp;
143         struct ast_hostent ahp;
144         hp = ast_gethostbyname(value, &ahp);
145         if (hp) {
146                 memcpy(&sin->sin_addr, hp->h_addr, sizeof(sin->sin_addr));
147         } else {
148                 ast_log(LOG_WARNING, "Unable to lookup '%s'\n", value);
149                 return -1;
150         }
151         return 0;
152 }
153
154 /* iface is the interface (e.g. eth0); address is the return value */
155 int ast_lookup_iface(char *iface, struct in_addr *address) {
156         int mysock, res = 0;
157         struct my_ifreq ifreq;
158
159         memset(&ifreq, 0, sizeof(ifreq));
160         strncpy(ifreq.ifrn_name,iface,sizeof(ifreq.ifrn_name) - 1);
161
162         mysock = socket(PF_INET,SOCK_DGRAM,IPPROTO_IP);
163         res = ioctl(mysock,SIOCGIFADDR,&ifreq);
164
165         close(mysock);
166         if (res < 0) {
167                 ast_log(LOG_WARNING, "Unable to get IP of %s: %s\n", iface, strerror(errno));
168                 memcpy((char *)address,(char *)&__ourip,sizeof(__ourip));
169                 return -1;
170         } else {
171                 memcpy((char *)address,(char *)&ifreq.ifru_addr.sin_addr,sizeof(ifreq.ifru_addr.sin_addr));
172                 return 0;
173         }
174 }
175
176 int ast_ouraddrfor(struct in_addr *them, struct in_addr *us)
177 {
178 #if defined(__OpenBSD__) || defined(__NetBSD__) || defined(__FreeBSD__)
179         struct sockaddr_in *sin;
180         struct sockaddr *sa;
181         struct {
182                 struct  rt_msghdr m_rtm;
183                 char    m_space[512];
184         } m_rtmsg;
185         char *cp, *p = ast_strdupa(inet_ntoa(*them));
186         int i, l, s, seq, flags;
187         pid_t pid = getpid();
188         static int routeseq;    /* Protected by "routeseq_lock" mutex */
189
190         memset(us, 0, sizeof(struct in_addr));
191
192         memset(&m_rtmsg, 0, sizeof(m_rtmsg));
193         m_rtmsg.m_rtm.rtm_type = RTM_GET;
194         m_rtmsg.m_rtm.rtm_flags = RTF_UP | RTF_HOST;
195         m_rtmsg.m_rtm.rtm_version = RTM_VERSION;
196         ast_mutex_lock(&routeseq_lock);
197         seq = ++routeseq;
198         ast_mutex_unlock(&routeseq_lock);
199         m_rtmsg.m_rtm.rtm_seq = seq;
200         m_rtmsg.m_rtm.rtm_addrs = RTA_IFA | RTA_DST;
201         m_rtmsg.m_rtm.rtm_msglen = sizeof(struct rt_msghdr) + sizeof(struct sockaddr_in);
202         sin = (struct sockaddr_in *)m_rtmsg.m_space;
203         sin->sin_family = AF_INET;
204         sin->sin_len = sizeof(struct sockaddr_in);
205         sin->sin_addr = *them;
206
207         if ((s = socket(PF_ROUTE, SOCK_RAW, 0)) < 0) {
208                 ast_log(LOG_ERROR, "Error opening routing socket\n");
209                 return -1;
210         }
211         flags = fcntl(s, F_GETFL);
212         fcntl(s, F_SETFL, flags | O_NONBLOCK);
213         if (write(s, (char *)&m_rtmsg, m_rtmsg.m_rtm.rtm_msglen) < 0) {
214                 ast_log(LOG_ERROR, "Error writing to routing socket: %s\n", strerror(errno));
215                 close(s);
216                 return -1;
217         }
218         do {
219                 l = read(s, (char *)&m_rtmsg, sizeof(m_rtmsg));
220         } while (l > 0 && (m_rtmsg.m_rtm.rtm_seq != 1 || m_rtmsg.m_rtm.rtm_pid != pid));
221         if (l < 0) {
222                 if (errno != EAGAIN)
223                         ast_log(LOG_ERROR, "Error reading from routing socket\n");
224                 close(s);
225                 return -1;
226         }
227         close(s);
228
229         if (m_rtmsg.m_rtm.rtm_version != RTM_VERSION) {
230                 ast_log(LOG_ERROR, "Unsupported route socket protocol version\n");
231                 return -1;
232         }
233
234         if (m_rtmsg.m_rtm.rtm_msglen != l)
235                 ast_log(LOG_WARNING, "Message length mismatch, in packet %d, returned %d\n",
236                                 m_rtmsg.m_rtm.rtm_msglen, l);
237
238         if (m_rtmsg.m_rtm.rtm_errno) {
239                 ast_log(LOG_ERROR, "RTM_GET got %s (%d)\n",
240                                 strerror(m_rtmsg.m_rtm.rtm_errno), m_rtmsg.m_rtm.rtm_errno);
241                 return -1;
242         }
243
244         cp = (char *)m_rtmsg.m_space;
245         if (m_rtmsg.m_rtm.rtm_addrs)
246                 for (i = 1; i; i <<= 1)
247                         if (m_rtmsg.m_rtm.rtm_addrs & i) {
248                                 sa = (struct sockaddr *)cp;
249                                 if (i == RTA_IFA && sa->sa_family == AF_INET) {
250                                         sin = (struct sockaddr_in *)sa;
251                                         *us = sin->sin_addr;
252                                         ast_log(LOG_DEBUG, "Found route to %s, output from our address %s.\n", p, inet_ntoa(*us));
253                                         return 0;
254                                 }
255                                 cp += sa->sa_len > 0 ?
256                                           (1 + ((sa->sa_len - 1) | (sizeof(long) - 1))) :
257                                           sizeof(long);
258                         }
259
260         ast_log(LOG_DEBUG, "No route found for address %s!\n", p);
261         return -1;
262 #else
263         FILE *PROC;
264         unsigned int remote_ip;
265         int res = 1;
266         char line[256];
267         remote_ip = them->s_addr;
268         
269         PROC = fopen("/proc/net/route","r");
270         if (!PROC) {
271                 bzero(us,sizeof(struct in_addr));
272                 return -1;
273         }
274         /* First line contains headers */
275         fgets(line,sizeof(line),PROC);
276
277         while (!feof(PROC)) {
278                 char iface[256];
279                 unsigned int dest, gateway, mask;
280                 int i,fieldnum;
281                 char *fields[40];
282
283                 fgets(line,sizeof(line),PROC);
284
285                 fieldnum = 0;
286                 for (i=0;i<sizeof(line);i++) {
287                         char *offset;
288
289                         fields[fieldnum++] = line + i;
290                         offset = strchr(line + i,'\t');
291                         if (offset == NULL) {
292                                 /* Exit loop */
293                                 break;
294                         } else if (fieldnum >= 9) {
295                                 /* Short-circuit: can't break at 8, since the end of field 7 is figured when fieldnum=8 */
296                                 break;
297                         } else {
298                                 *offset = '\0';
299                                 i = offset - line;
300                         }
301                 }
302                 if (fieldnum >= 8) {
303
304                         sscanf(fields[0],"%s",iface);
305                         sscanf(fields[1],"%x",&dest);
306                         sscanf(fields[2],"%x",&gateway);
307                         sscanf(fields[7],"%x",&mask);
308 #if 0
309                         printf("Addr: %s %08x Dest: %08x Mask: %08x\n", inet_ntoa(*them), remote_ip, dest, mask);
310 #endif          
311                         /* Looks simple, but here is the magic */
312                         if (((remote_ip & mask) ^ dest) == 0) {
313                                 res = ast_lookup_iface(iface,us);
314                                 break;
315                         }
316                 }
317         }
318         fclose(PROC);
319         if (res == 1) {
320                 ast_log(LOG_WARNING, "Yikes!  No default route?!!\n");
321                 bzero(us,sizeof(struct in_addr));
322                 return -2;
323         } else if (res) {
324                 /* We've already warned in subroutine */
325                 return -1;
326         }
327         return 0;
328 #endif
329 }